Instapaper 4.2.2 with Background Update Locations
blog.instapaper.com
blog.instapaper.com
It is neat that people are finding these loopholes, though. Any Downcast devs reading this? Hint hint hint...
JSON-P doesn't mean that same-origin is a waste of time just because there's a work-around - it demonstrates that sites should be allowed to opt-out of same-origin protection if they have a reason to, leading to the development of CORS.
Without same-origin protection, I could run JavaScript on any website which silently used XMLHttpRequest to steal information from a web server running on your company's internal intranet. All I'd have to do then is trick you in to visiting my site.
edit: Apparentley Instapaper = Instagram when I am on HN way too early for a Sunday.
https://twitter.com/marcoarment/statuses/209073534289448961
Cool, Ive never seen that before.